CSE Roadmap

Common tier · about 5 hours · 11 parts

Part 9 of 11 · 2 min read

Secrets and clutter

What to leave out of a repository, and what to do, in the right order, when a secret is committed.

Not everything in your project folder belongs in history. Some files are clutter (they can be regenerated), and some are secrets (they must never be shared).

A file named .gitignore lists patterns that Git should never track:

.venv/
__pycache__/
.env
*.egg-info/
.pytest_cache/
  • .venv/ and __pycache__/ are generated by Python and are different on every computer.
  • .env holds settings and API keys for your machine (Level 0, module 6 explains this file).
  • A pattern ending in / matches a folder, and * matches any characters.

.gitignore only works on files Git is not tracking yet

If a file was already committed, adding its name to .gitignore does not stop Git tracking it. You must also run git rm --cached .env, which stops tracking the file but leaves it on your disk. And even then, the old content stays in history:

console $ git rm --cached .env $ git commit -m "stop tracking .env" $ git log -p -- .env | grep API -API_KEY=not-a-real-key +API_KEY=not-a-real-key

Every version that was ever committed is still there, and anyone who clones the project can read it.

If a secret was committed, treat it as stolen

A pushed repository can be copied, or scanned by automatic bots, within minutes. The correct order matters:

  1. Revoke or rotate the key at the provider (create a new one and cancel the old one). This is the only step that closes the hole.
  2. Remove it from the code and load it from the environment instead.
  3. Clean the history if you need to, with a tool such as git filter-repo. This makes the repository tidy but does not make the key safe again, because copies may exist.
For the curious Going deeper: stopping secrets before they are committed

Teams add two safety nets. A pre-commit hook is a small script Git runs before every commit, and it can run a secret scanner on the staged files. GitHub's push protection can also refuse a push that contains a known kind of key. Neither replaces a good habit, and neither is perfect, which is why rotation stays step one.